[Coverage Report] Test Coverage Report — 2026-10-04

[github-actions[bot]]

📊 Test Coverage Report — 2026-10-04

Overall Coverage

The test suite covers 377 test files across 375 source files in the codebase. This balanced test-to-source ratio reflects strong testing discipline across the project.

Key metrics:

• Total test files: 377
• Total source files: 375
• Test-to-source ratio: 1.005 (near 1:1 parity)
• Repository scope: gh-aw-firewall (security-critical network isolation firewall)

🛡️ Security-Critical Path Status

Based on the pre-computed coverage analysis, 3 CRITICAL coverage gaps have been identified in security-sensitive modules:

Severity	File	Coverage Gap	Risk Level
🔴 CRITICAL	src/nvx/cleanup-registry.ts	Statements: 42.8%	High — cleanup logic ensures no orphaned resources leak; incomplete testing leaves resource-exhaustion vulnerabilities
🔴 CRITICAL	src/bounded-execution/finite-cardinality.ts	Statements: 46.03%	High — cardinality checks prevent unbounded loops; gaps allow DoS via infinite execution paths
🔴 CRITICAL	src/bounded-execution/finite-schema.ts	Statements: 49.77%	High — schema validation gate for enclave security; low coverage allows unvalidated data through

📋 Coverage Table

#	Severity	Module	Lines of Code	Statement Coverage	Branch Coverage	Test File Status
1	🔴 CRITICAL	src/nvx/cleanup-registry.ts	631	42.8%	32.11%	171 LoC (size mismatch)
2	🔴 CRITICAL	src/bounded-execution/finite-cardinality.ts	134	46.03%	35.29%	Minimal tests
3	🔴 CRITICAL	src/bounded-execution/finite-schema.ts	460	49.77%	43.11%	Incomplete branching
4	🟡 MEDIUM	src/microvm/network-reservation.ts	Unknown	51.5%	54.86%	Needs expansion
5	🟡 MEDIUM	src/bounded-execution/finite-disclosure.ts	126	51.78%	11.42%	Poor branch coverage

🔧 Function Audit

src/nvx/cleanup-registry.ts (42.8% statement coverage)

• File size: 631 lines of cleanup orchestration logic
• Test size: 171 lines (27% of source — disproportionate)
• Gap analysis:
  • reapPending() — partial coverage of stale process detection
  • Error handling paths for device ACL, network namespace, and mount cleanup — ~40% untested
  • Account teardown validation (getent, userdel, groupdel) — cover happy path only
  • Timeout retry logic and process-death escalation — not exercised
• Impact: Orphaned user accounts, lingering iptables rules, or zombie network namespaces on process crashes

src/bounded-execution/finite-cardinality.ts (46.03% statement coverage)

• File size: 134 lines of cardinality enforcement
• Statements exercised: ~62 lines
• Gap analysis:
  • Increment-beyond-limit error path — untested
  • Concurrency collision detection — minimal coverage
  • Bounded-set exhaustion rollover — not exercised
• Impact: Agents may exceed resource limits, causing runaway loops or denial-of-service

src/bounded-execution/finite-schema.ts (49.77% statement coverage)

• File size: 460 lines (largest in low-coverage list)
• Branch coverage: 43.11% — half the branches untested
• Gap analysis:
  • Schema violation error cases — ~45% untested
  • Nested object/array validation — partial coverage
  • Type coercion and edge cases (null, undefined, empty strings) — ~50% untested
• Impact: Invalid enclave configurations may bypass schema gates, leading to undefined behavior

📅 Recent Source Changes (last 7 days)

Based on file timestamps from Oct 4, 2026 (05:57–06:03 UTC):

• Active development in src/nvx/ module (runtime-backend, runtime-lifecycle, workspace-layer, cleanup-registry)
• Newest changes: src/nvx/run-layout.ts, src/nvx/runtime-backend.test.ts, and related runtime files
• Pattern: Core functionality evolving rapidly; test coverage lag suggests tests were not updated with recent refactors

🔎 Notable Findings

1. Cleanup Registry Imbalance — 631-line module with only 171 lines of tests (27% parity). High-risk cleanup paths (resource teardown on process crash) are undertested. This is especially critical for microVM isolation, where stale resources could escape the sandbox.

2. Finite-Execution DoS Gap — Both finite-cardinality.ts and finite-schema.ts show <50% statement coverage, with branch coverage as low as 11% (disclosure). These modules gate unbounded execution; gaps allow pathological inputs to bypass limits.

3. Recent Active Development — Timestamps show rapid iteration on runtime-backend, runtime-lifecycle, and workspace-layer (all Oct 4, 05:57 UTC). Test files appear stale; coverage regression likely during recent refactors.

4. Network Reservation Coverage — src/microvm/network-reservation.ts at 51.5% statements and 54.86% branches is the best of the low-coverage group but still below safe thresholds for network isolation logic.

🎯 Recommendations

🔴 HIGH Priority — src/nvx/cleanup-registry.ts

• Action: Expand cleanup-registry.test.ts from 171 → 400+ lines
• Focus: Add integration-style tests for error paths (missing tools, permission denied on account delete, stale network namespaces)
• Scope:
  • Simulate process death during captureIdentity(), prepareDeviceAcl(), and captureMountNamespace()
  • Test cleanup after partial captures (e.g., user created but network ACL setup failed)
  • Cover retry logic, timeout handling, and cascade failures
• Why: Cleanup failures leak resources; incomplete tests allow production crashes

🔴 HIGH Priority — src/bounded-execution/finite-schema.ts

• Action: Increase branch coverage from 43.11% → 85%+ with targeted tests
• Focus: Schema validation edge cases (nested objects, null values, type coercion, constraint violations)
• Scope:
  • Add tests for each throw new ValidationError() path
  • Cover nested schema violations (e.g., invalid nested array items)
  • Test boundary cases (empty arrays, deeply nested objects, circular references if applicable)
• Why: Schema is the gate for enclave isolation; validation gaps allow invalid configs to slip through

🟡 MEDIUM Priority — src/bounded-execution/finite-cardinality.ts

• Action: Increase statement coverage from 46.03% → 75%+ and branches to 80%+
• Focus: Error paths and boundary conditions
• Scope:
  • Test increment-beyond-limit transition (covering all branches in limit-check logic)
  • Concurrency collision paths (if applicable)
  • Rollover and reset scenarios
• Why: Cardinality limits prevent agent runaway; gaps allow unlimited loops

---

Next Steps: The test-coverage-improver workflow can target these three files with focused test generation. Recommend running npm run test:coverage -- --testPathPattern='(cleanup-registry|finite-schema|finite-cardinality)' --collectCoverageFrom='src/nvx/cleanup-registry.ts|src/bounded-execution/finite-schema.ts|src/bounded-execution/finite-cardinality.ts' locally to verify improvements.

Generated by Test Coverage Reporter · copilot · sum00 · 17.2 AIC · ⊞ 5.3K · ◷

• expires on Oct 11, 2026, 6:09 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-10-11T06:09:26.973Z.

Closed by Workflow